Identifies vulnerabilities and security risks of firewalls, routers, networks, operating systems, applications and new technology initiatives, in support of security assessment and authorization. Develops Test Plans and Assessment reports. Evaluates commercial and open source tools for potential inclusion in the Security Assessment Team approved baseline. Performs Penetration testing of Cross Domain Solutions and other technologies, as required by applicable security directives and upon request. Coordinates test schedules and resources with system security personnel and test team members. Works independently for smaller efforts and as part of a team for larger assessment efforts.
Applicants selected will be subject to a government security investigation and must meet eligibility requirements for access to classified information. Top Secret clearance is required w/ the ability to get SCI.
Successful candidates must possess a thorough working knowledge of common commercial and/or open source vulnerability assessment tools and techniques used for evaluating operating systems, networking devices, databases and web applications.
Successful candidates should be familiar with certification and accreditation processes in general; experience with the NIST 800 series of documents would be advantageous.
Successful candidates must be able to quickly master new technology / software for the purposes of evaluating or subverting the security functionality of the technology / software.
The security projects undertaken by the Security Assessment Team (SAT) range in complexity and duration but typically require two weeks planning, two weeks on site, and two weeks to analyze information and report findings. The level of effort and number of security assessors required for each assessment is based on the criticality of the system, technology, and schedule.
The SAT performs both lab-based penetration testing and grey and crystal box penetration testing of production systems; each type is tailored towards the specific objectives of the project. A variety of tools and techniques are used including threat modeling and simulation, social engineering, and other common techniques utilized by adversaries. Penetration testing complements a comprehensive vulnerability assessment.
Candidate will provide technical information system security testing (i.e., Security Test and Evaluation (ST&E) and/or Certification Test and Evaluation (CT&E)) for initial accreditation, re-accreditation, continuous monitoring and remedial actions required to comply with accreditation (information systems accredited with a lien). Techniques used in the CT&E and ST&E include network and application vulnerability testing (both automated and manual testing), network and application penetration testing, use of DISA Gold Disk, use of DISA System Readiness Review (SRR) scripts, and may include source code analysis. This includes, but is not limited to, performing all required information system security certification tasks during definition/concept; development; installation, checkout and verification; penetration testing; and operations and maintenance phases for new or legacy information systems in accordance with the FBI Certification and Accreditation Handbook.
The candidate shall develop documentation in support of testing efforts that may include: Security Assessment Test Plans, Penetration Test Plans, Assessment Test Reports, and other, similar test artifacts, as required by the government.
Candidates should be skilled in multiple of the following areas:
- Networking / Network Engineering / Network Administration: expert understanding and extensive experience in a broad range of networking concepts, technologies, architectures, and security concerns specific to networking, to include wireless networking and the security issues surrounding it. – advanced Cisco certifications required.
- Operating Systems: expert understanding of the following operating systems and their related security concerns – Microsoft, Solaris, and UNIX certifications required:
- Microsoft Windows desktop/server operating systems
- UNIX and Linux, specifically Ubuntu, Red Hat, and knowledge of other UNIX variants
- Apple Macintosh operating systems
- Microsoft Solutions: Active Directory, Exchange, SharePoint, and other core software solutions and their related security concerns.
- Enterprise Solutions, Storage & Databases: advanced understanding of relational database, database management systems, enterprise storage solutions, and security concerns specific to these technologies.
- Software Programming: advanced experience with at least JAVA, Microsoft .NET, and C++. Experience with Python, Perl, Ruby, UNIX Shell Scripting.
- Mainframe: hardware, operating systems, networking, and security best practices.
In addition to one or more of the critical skills listed above, all candidates must be knowledgeable in the following areas:
- All candidates shall be comfortable using, configuring, troubleshooting, and administering both UNIX and Microsoft operating systems with extensive experience with at least one of these operating systems.
- Have a broad knowledge of security best practices, security solutions, and methodologies for conducting advanced security assessments, to include manual assessments and malicious user testing.
- Have a solid understanding of NIST - especially 800-53 rev 3 and 800-53a.
- Have a broad and expert knowledge of security assessment tools (commercial, free/shareware) and manual security testing techniques. Advanced understanding of security tool strengths and weaknesses and ability to select, configure, troubleshoot and use the best “tool for the job”.
- Have a broad knowledge of cyber security threats and techniques used by adversaries to compromise systems – both technical and non-technical techniques.
- Have the ability to think creatively, to think critically, to analyze complex concepts, to articulate themselves clearly and concisely, and to conduct themselves in a professional manner.
- *One of the following Certifications Required: Certified Information Security Professionals (CISSP), SANS GIAC Certified Incident Handler (GCIH), GIAC Certified Penetration Tester (GPEN), or GIAC Certified Web Application Penetration Tester (GWAPT).
- SAT members responsible for leading the assessment of web applications shall possess the GWAPT or equivalent certification and those leading penetration testing engagements shall possess the GPEN or equivalent.